Microsoft Defender: Are There Other Winners?
February 1, 2022
I believe everything I read on the Internet, of course. One of the fascinating aspects of being old and doing the 21st century equivalent of clipping coupons is coming across “real” research studies. I read “Still Think Microsoft Defender Is Bad? Think Again, Says AV-TEST.”
The write up in Make Use Of Dot Com believes in Windows Defender. It article states:
A recent report by AV-TEST revealed that not only does Microsoft Defender perform well, it actually outperforms many highly-recommended antiviruses
The article included a link to the AV-Test December 2021 Report, and I downloaded it. The AV Test outfit is “the independent IT security institute.” The investment firm Triton owns Swiss IT Security, which is the outfit which “owns” AV-Test.
What does Swiss IT Security Group AG do? Security, consulting, the cloud, and related services.
What does the SITS Group care about Microsoft and its assorted products? With Microsoft’s wide use in organizations, SITS Group probably has an above average keenness for the Redmond wizards’ constructs.
What does this mean for the victory of the Windows Defender system in the AV-TEST Report? For me, I formulated several hypotheses:
- Windows Defender is now able to deal with the assorted threats directed at Microsoft operating systems? Rest easy. Malware popping up on a Windows device is obviously something that is unlikely to occur. Thank goodness.
- Cheerleading for Windows Defender probably makes Microsoft’s security team feel warm and fuzzy which will allow their efforts to deal with Exchange Server issues a more pleasant experience.
- Bad actors will have to rethink how to compromise organizations with Microsoft software. Perhaps some of these individuals will give up criminal activity and join the Red Cross or its equivalent.
For me, institutes which do not reveal their ownership are interesting outfits. But how many antivirus vendors achieved the lofty rank of Windows Defender, according to the report dated December 2021? Here they are:
Avira
Bull Guard
ESET
F Secure
Kaspersky
McAfee
Norton 360
Total Security
Viper.
Windows Defender makes 10 “winners.”
Now of these 10 which is the one that will make SolarWinds, ransomware, compromised Outlook emails, and Azure Cosmos excitement a thing of the past? Another question: “Which of these sort of work in the real world?” And, “If there is a best, why do we need the nine others?”
These are questions one can ask Triton / Swiss IT Security Group AG / AV Test to answer?
Net net: Marketing.
Stephen E Arnold, February 1, 2022
Insider Threats: Still a Useful Mechanism for Bad Actors
January 27, 2022
I read “Ransomware Gangs Increase Efforts to Enlist Insiders for Attacks.” I am not down with the notion of “increase efforts.” Identifying individuals who will provide user names, passwords, or facile fingers to slip a malware loaded USB key into a computer connected to an organization’s network has been a go-to method for a long, long time.
The write up states:
The survey was conducted by Hitachi ID, which performed a similar study in November 2021. Compared to the previous survey, there has been a 17% rise in the number of employees offered money to aid in ransomware attacks against their employer. Most specifically, 65% of the survey respondents say that they or their employees were approached between December 7, 2021, and January 4, 2022, to help hackers establish initial access.
The factoid in the magic-with-statistics write up is that a lot of individuals report brushes with the insider ploy. What’s important to remember, an insider can come from several different pools of people:
- There are disaffected employees who can be identified and then interviewed for a bogus news service or for a consulting job. A skilled contact working with an annoyed employee can often extract what might be termed a mother lode of useful information, including details about security, access, and other disaffected employees who want to put it to the “man” or “woman” who ruined a perfectly good morning of reading online news.
- Clueless former employees who respond to a LinkedIn-type job posting or an engaging individual in what sure looks like a chance encounter. Some individuals need or love money, and the engaging individual can buy or solicit security information from the CFE (clueless former employee).
- Happy current employees who find themselves confronted with a person who has information about a past indiscretion memorialized on Instagram, Meta, or TikTok. Maybe the current happy employee has forgotten text and images sent to an individual with some interesting preferences or behaviors. Blackmail? Well, more like leveraging TikTok-type data to identify and screen potential targets.
- Contractors — those faceless, often nameless — individuals who have to eat in their cube, not the two-star real employee cafeteria. Contractors can be hired and one can interact with these professionals. It is possible that these individuals can provide the keys to the kingdom so to speak without knowing the treasures unlocked with what seems to be casual conversation.
- Children of employees can be asked to give mom or dad a USB. The unwitting employee slams the key into the slot unaware that it has been weaponized. Who asks kids? A skilled operative can present herself as a colleague at the front door, explain this was your mom or dad’s memory stick, and ask the young person to hand it over to the parent. (If this method works, bingo. If it fails, another approach can be made. Wearing Covid masks and dressing in normcore gray with a worn ball cap can help too.)
Why am I identifying pools of insiders? Most of the cyber security firms do not have systems which cover these points of insider vulnerability. Do some of the firms purport to have these bases covered?
Of course.
That’s the point. The customer won’t know until it is too late. Predictive analytics and cyber threat intelligence struggle in certain situations. Insiders is one such example.
Stephen E Arnold, January 27, 2022
Excited about Microsoft and Games? What about Other Issues? Like, Uh, Security?
January 25, 2022
We learn of a recent complaint against SolarWinds from GitHub contributor jaybobo, who helpfully shares both the full filing and key highlights. The case was filed in Delaware’s Court of Chancery by shareholders, including the Construction Industry Laborers Pension Fund and the Central Laborers’ Pension Fund. In light of the Sunburst hack, the plaintiffs assert the company failed to appropriately secure their investments against cybersecurity risks. The complaint alleges:
“SolarWinds: (i) used weak passwords for its software download webpages such as ‘solarwinds123;’ (ii) did not properly segment its IT network; (iii) directed its clients to disable antivirus scanning and firewall protection on its Orion software; (iv) cut investments in cybersecurity; and (v) listed its sensitive and high-value clients on its webpage for anyone to see.”
Oof—these are indeed the opposite of security best practices. The parties insist this alleged negligence allowed the Sunburst attack to succeed, tanking their investments. The filing describes the impact:
“In the days following the Company’s initial public disclosure of SUNBURST in December 2020, SolarWinds’ stock lost nearly 40% of its value. As of today, the stock trades at more than a 30% discount to its pre-revelation trading price. For the six months ended June 30, 2021, the Company incurred $34 million in direct expenses related to SUNBURST, stemming from, inter alia, costs to investigate and remediate the cyber attack; legal, consulting, and other professional service expenses; and public relations costs. In the first six months ended June 30, 2021, the Company also experienced a 27% decline in its license revenue relative to the previous year. SolarWinds explained that this decline was ‘primarily due to decreased sales of our licensed products as a result of the Cyber Incident [i.e., SUNBURST]’ (among other factors). The Company’s net increase in cash and cash equivalents for the same period was down over 74% relative to the previous year, which the Company also attributed, in part, to SUNBURST.”
The plaintiffs go on to note several ongoing investigations and lawsuits now facing SolarWinds as a result of the debacle. Then there are the related insurance rate hikes, finance charges, and compliance activities. They estimate these factors add another $20 million a year in expenses that will also diminish their investments. The filing requests several measures from the court, like requiring the company to implement better security and, of course, awarding damages.
We want to point out the information in “Microsoft Discovers Undisclosed Bug in SolarWinds Server.” That write up which we spotted on January 22, 2022 (a Saturday by the way) states:
During the sustained monitoring of threats taking advantage of the ‘Log4j2’ vulnerabilities, the Microsoft Threat Intelligence Centre (MSTIC) team observed activity related to attacks being propagated via a previously undisclosed vulnerability in the SolarWinds ‘Serv-U’ software. “We discovered that the vulnerability is an input validation vulnerability that could allow attackers to build a query given some input and send that query over the network without sanitation,” Microsoft said in its security update. SolarWinds said the Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized.
Worth monitoring security, but the metaverse more zippy.
Cynthia Murrell, January 25, 2021
How about Chinese Infiltration: Subtle Sometimes?
January 19, 2022
I read “MI5 Warning about Influence Efforts of British Chinese Lawyer Marks Changed Tone.” Poor Brexit tangled Britain. France24, an outfit intimately familiar with hundreds of types of fromage, reported:
In a warning sent to all British parliamentarians, MI5 accused [Christine] Lee, 58, of acting covertly and in coordination with the United Front Work Department of the Chinese Communist Party, one of Beijing’s overseas propaganda organs, by facilitating financial donations to political parties, parliamentarians and those seeking political office in the UK. The rare alert “reflects the fact that the security services are pretty worried about what China is doing in this country, both in terms of traditional espionage, which this isn’t, but also in terms of modern forms of interference and influence,” Charles Parton, a fellow at the Royal United Services Institute think tank, told the Financial Times. MI5 says that Lee, a long-time resident of London, is suspected of attempting to buy the favor of prominent parliamentarians, both on the right and the left of the political spectrum.
Are the allegations true? Who knows? They do indicate that the stiff upper lip crowd is becoming more sensitive to the cracks and fissures foreign entities can use to influence certain aspects of British behavior. I wonder if Brexit was an example of foreign acupuncture? France24 is likely to provide more reports about British security “issues.”
Stephen E Arnold, January 19, 2022
A New Spin on Tech Recruitment
January 7, 2022
“Knock Knock! Who’s There? – An NSA VM” is an interesting essay for three reasons.
First, it contains a revealing statement about the NSO Group:
Significant time has passed and everyone went crazy last week with the beautiful NSO exploit VM published by Project Zero, so why not ride the wave and present a simple NSA BPF VM. It is still an interesting work and you have to admire the great engineering that goes behind this code. It’s not everyday that you can take a peek at code developed by a well funded state actor.
I noticed that the write up specifically identifies the NSO Group as a “state actor.” I think this means that NSO Group was working for a country, not the customers. This point is one that has not poked through the numerous write ups about the Israel-based company.
Second, the write up walks through a method associated with the National Security Agency. In terms of technical usefulness, one could debate whether the write up contains old news or new news. The information does make it clear that there are ideas for silent penetration of targeted systems. The targets are not specific mobile phones. It appears that the targets of the methods referenced and the sample code provided are systems higher in the food chain.
Third, the write up is actually a recruitment tool. This is not novel, but it is probably going to lead to more “look how smart and clever we are, come join us” blandishments in the near future. My hunch is that some individual, eager to up their games, will emulate the approach.
Is this method of sharing information a positive or negative? That depends on whom one asks, doesn’t it?
Stephen E Arnold, January 7, 2022
TikTok: Innocuous? Maybe Not Among Friends
January 5, 2022
Short videos. No big deal.
The data about one’s friends are a big deal. A really big deal. TikTok may be activating a network effect. “TikTok Tests Its Own Version of the Retweet with a New Repost Button” suggests that a Twitter function is chugging along. What if the “friend” is not a registered user of TikTok? Perhaps the Repost function is a way to expand a user’s social network. What can one do with such data? Building out a social graph and cross correlating those data with other information might be a high value exercise. What other uses can be made of these data a year or two down the road? That’s an interesting question to consider, particularly from the point of view of Chinese intelligence professionals.
“China Harvests Masses of Data on Western Targets, Documents Show” explains that China acquires data for strategic and tactical reasons. The write up doses not identify specific specialized software products, services, and tools. Furthermore, the price tags for surveillance expenditures seem modest. Nevertheless, there is a suggestive passage in the write up:
Highly sensitive viral trends online are reported to a 24-hour hotline maintained by the Cybersecurity administration of China (CAC), the body that oversees the country’s censorship apparatus…
What’s interesting is that China uses both software and human-intermediated systems.
Net net: Pundits and users have zero clue about China’s data collection activities in general. When it comes to specific apps and their functions on devices, users have effectively zero knowledge of the outflow of personal data which can be used to generate a profile for possible coercion. Pooh pooh-ing TikTok? Not a great idea.
Stephen E Arnold, January 5, 2022
Microsoft Security? Just Super Duper
December 31, 2021
I installed software on one of my test machines. Windows’ Defender tool told me I had malware. Not true. To see what would happen, I clicked the offered Defender button and Windows killed a program from a developer doing business as Chris-PC. Helpful? You bet.
I mention this because I think I am the only person in Harrod’s Creek who believes that the Windows 11 release was a way to distract people from Microsoft’s security challenges. I like words like “challenges” and “misstep” because “dumpster fire” is too colorful and “disaster” has been overused.
What’s up with Microsoft security challenges as we creep toward what will be a banner year for some actors? How about these two news stories?
First, we have “Microsoft Teams Bug Allowing Phishing Unpatched Since March.” The main idea is that nine months have bustled by. Teams users could fall victim to some missteps in Microsoft Teams. The write up states:
German IT security consultancy firm Positive Security’s co-founder Fabian Bräunlein discovered four vulnerabilities leading to Server-Side Request Forgery (SSRF), URL preview spoofing, IP address leak (Android), and denial of service (DoS) dubbed Message of Death (Android). Bräunlein reported the four flaws to the Microsoft Security Response Center (MSRC), which investigates vulnerability reports concerning Microsoft products and services. “The vulnerabilities allow accessing internal Microsoft services, spoofing the link preview, and, for Android users, leaking their IP address and DoS’ing their Teams app/channels,” the researcher said. Out of the four vulnerabilities, Microsoft addressed only the one that attackers could use to gain access to targets’ IP addresses if they use Android devices.
Second, we have “Stealthy BLISTER Malware Slips in Unnoticed on Windows Systems.” I learned:
… Blister, acts as a loader for other malware and appears to be a novel threat that enjoys a low detection rate. The threat actor behind Blister has been relying on multiple techniques to keep their attacks under the radar, the use of code-signing certificates being only one of their tricks.
Nope, let’s block Windows 11 users from installing another browser. Let’s kill Chis-PC software. The path forward is to enter 2022 with the ghost of SolarWinds laughing and the ghosts of Christmas yet to come licking their lips in glee.
Stephen E Arnold, December 31, 2021
Log4Shell: Tough to Hide This Fire
December 28, 2021
Billy Joel is absolutely right when he sang the acclaimed song “We Didn’t Start The Fire” about the world’s slow demise. Unlike the planet, the Internet is regularly set ablaze and the demise is quick. The current flame is “Log4Shell” and it gives bad actors back doors into clouds and enterprise systems to steal data, download malware, erase information, and cause mayhem. AP News explores the breach in: “‘The Internet’s On Fire’ As Techs Race To Fix Software Flaw.”
The bug dubbed “Log4Shell” originated in open source Apache software used to run Web sites and other Web services. While open source software is a boon to the world, it is not updated as quickly as proprietary software. Amazon, for example, updates itself daily while systems running Apache only update at their owners’ behest.
Funny enough the “Log4Shell” vulnerability was first noticed in a children’s game:
“The first obvious signs of the flaw’s exploitation appeared in Minecraft, an online game hugely popular with kids and owned by Microsoft. Meyers and security expert Marcus Hutchins said Minecraft users were already using it to execute programs on the computers of other users by pasting a short message in a chat box.Microsoft said it had issued a software update for Minecraft users. ‘Customers who apply the fix are protected, it said.”
Cyber security is not child’s play, but hacking is for some bad actors. Thankfully developers are working on a patch to prevent further damage. Security professionals really should not panicking and combine their knowledge to find a solution quicker.
A couple of points:
- The issue allegedly was disclosed by an Alibaba tech professional, possibly Chen Zhaojun
- China suspender an apparently “big” cyber security deal with Alibaba after the disclosure
Are these two actions connected; specifically, did China lose control of a really nifty zero day? Beyond Search thinks that the career trajectory of some Alibaba professionals will be interesting to watch. Are there IT jobs in Ürümqi?
Whitney Grace, December 28, 2021
Whitney Grace, December 27, 2021
DarkCyber for December 28, 2021, Now Available
December 28, 2021
This is the 26th program in the third series of DarkCyber video news programs produced by Stephen E Arnold and Beyond Search. You can view the ad-free show at this url. This program includes news of changes to the DarkCyber video series. Starting in January 2022, Dark Cyber will focus on smart software and its impact on intelware and policeware. In addition, Dark Cyber will appear once each month and expand to a 15 to 20 minute format.
What will we do with the production time? We begin a new video series called “OSINT Radar.” OSINT is an acronym for open source intelligence. In a December 2021 presentation to cyber investigators, the idea surfaced of a 60 second profile of a high value OSINT site. We have developed this idea and will publish what we hope will be a weekly video “infodeck” in video form of an OSINT resource currently in use by law enforcement and intelligence professionals. Watch Beyond Search for the details of how to view these short, made-for-mobile video infodecks. Now when you swipe left, you will learn how to perform free reverse phone number look ups, obtain a list of a social media user’s friends, and other helpful data collection actions from completely open source data pools.
Also, in this DarkCyber program are: [a] the blame for government agencies and specialized software vendors using Facebook to crank out false identities. Hint: It’s not the vendors’ fault. [b] why 2022 will be a banner year for bad actors. No, it’s not just passwords, insiders, and corner-cutting software developers. There is a bigger problem. [c] Microsoft has its very own Death Star. Does Microsoft know that the original Death Star was a fiction and it did not survive an attack by the rebels?, and [d] a smart drone with kinetic weapons causes the UN to have a meeting and decide to have another meeting.
Kenny Toth, December 28, 2021
Log Exploits, Pegasus Methods, and Willful Ignorance
December 21, 2021
Which of the “our hair is on fire” articles should I reference. There’s the “worse security issue ever” approach of the Security Now podcast. The Google released an analysis of NSO Group’s Pegasus methods. There’s the happy discovery story and community centric notification by an engineer working at a Chinese company. There’s Canada’s turning off quite a few essential government Web sites. And more. Lots more.
My take is that these post SolarWinds’ missteps are going to come faster and more furiously with or without Microsoft’s magical 1,000 engineers beavering away in lovely Moscow.
Why?
Three reasons, and I know these will not be particularly popular among the thumbtypers, the funders of venture backed cyber security firms, and the open source community. Hey, life is tough.
1. Good Enough
In order to reduce costs and move faster, good enough is the key business practice to have emerged in the last decade. Systems are assembled via chunks of code, APIs, and scripts conjured from online sources. As a result, there are obviously some egregious issues. The SolarWinds’ misstep is one example. The hair on fire over Java is another. We have a ring side seat to the Kendara start up which was sold to @Home which may have been AT&T, Java was exciting indeed. Now Java is different? Sorry. It’s good enough. Why not do “better”? It takes effort, money, and time. Foosball and making designer coffee are more important for some.
2. Open Source and the Community
Yeah, the appeal of free software, no proprietary software license agreements, and the ability to make changes which — ha ha ha — which coulda woulda shoulda been shared with the community are powerful rocket engines for open source applications. Now everything from Elasticsearch to the latest mobile device is like a clueless elderly person negotiating with a New York real estate wizard. You know who is going to win, right? The community is often a front for a commercial interest, a way for a developer to get a job, or a clever programmer to drive business to a consulting side gig. Who knows who will cobble together enough open source to solve one of the persistent problems with computing. The issue is that the “community” is not homogeneous and the fruit cake of code is neither subjected to testing for security issues or reworked to make it just more wonderful. Without an incentive, open source is almost as juicy a bad actor opportunity as that wonderful Microsoft Exchange “solution.”
3. Kick the Can Down the Road
In my more than 50 year work career, the most frequent answer to a persistent problem has been to find something expedient to ameliorate a problem. Then kick the can down the road for subsequent managers, programmers, and summer interns to solve. Whether the issue is the security of home smart devices or hidden vulnerabilities of a $200,000 per year piece of smart software infused with Snorkel goodness, just focus on the short term. Those larger issues? Hey, what are those? Just walk away from the dead whales on the beach. Technology and tomorrows will solve the less visible, longer term problems.
Net Net
What’s the fix for the hair on fire crowd? Oh, upgrade to the more secure version. License a smart system like Antigena. Introduce a new cyber threat information service. See how easy it is to operate in a digital world in which the vast majority of people are thrilled with the computing status quo. Life will be more secure and even better in the metaverse too.
Stephen E Arnold, December 20, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
